ci: track upstream instagrapi releases automatically

[subzeroid]

Summary

• Check GitHub's latest stable instagrapi release every day at 06:17 UTC, while preserving manual and repository dispatch triggers.
• Compare strict X.Y.Z versions against the canonical default-branch baseline, deduplicate exact tracker titles across open and closed issues, and fail closed on malformed or truncated GitHub responses.
• Run with queued concurrency, a 10-minute timeout, non-persistent checkout credentials, and only the repository GITHUB_TOKEN with contents: read and issues: write permissions.
• Document the tracker contract, dispatch payload, schedule caveats, and inactivity recovery flow.

Security

• No keys, passwords, tokens, or new repository secrets are added.
• The workflow uses only ${{ secrets.GITHUB_TOKEN }} and does not persist checkout credentials.
• The public diff and PR text were scanned for credential values.

Test Coverage

• AI-assessed changed-path coverage: 93% with no blocking gaps.
• The fake gh harness verifies exact CLI arguments, version ordering, invalid inputs, API/list/create failures, open and closed deduplication, near-match rejection, saturation fail-closed behavior, and generated issue metadata.
• Workflow structure is checked with PyYAML for triggers, schedule, permissions, concurrency, canonical checkout, timeout, environment, and script invocation.

Pre-Landing Review

No P0, P1, or P2 findings. Independent task-level spec and quality reviews also passed.

Scope Drift

Scope Check: CLEAN. The public diff contains exactly the intended workflow, tracker script, regression test, and upstream-sync documentation files.

Plan Completion

All implementation and verification tasks are complete. The tracker includes the accepted Bash 3.2 compatibility and fail-closed saturation improvements discovered during review.

Documentation

docs/upstream-sync.md covers the maintainer-only tracker as reference, how-to, and explanation; a tutorial is not needed.

Documentation Debt

• docs/development-guide.md: later mention the daily scheduled check and link to the upstream-sync policy. Deferred to preserve this PR's approved four-file scope.

Verification

• /bin/bash -n scripts/upstream_sync_tracker.sh
• Ruff check and format verification
• All configured pre-commit hooks
• 676 passed, 3 skipped, 35 subtests passed
• mkdocs build --strict
• GitHub and Codeberg branches point to commit 9440b53